IR Manager

Profero is an incident response company. When a customer calls, our team picks up: ransomware, business email compromise, cloud and identity compromise, supply chain attacks, insider cases. About 70% of the work is cloud, 30% on-premises.

Profero seeks an IR Manager to lead a team of senior responders day to day: who takes which case, who is on call, what leaves the building in a report, and who we hire next. This is a small team with no layers between you and the work, and you work with the founders directly.

Agentic IR is how we run incidents. AI agents with read-only access pull logs, correlate events across cloud, identity, endpoint, and code, build the timeline, and propose leads. A named responder decides what they look at next, checks what they find, and owns the conclusion. As manager you own how that works in practice: the briefs the agents run from, how findings get verified, and where the line sits between what an agent proposes and what a responder signs.

Core Responsibilities

• Own the process: every incident gets a named lead within minutes, load stays balanced, and nothing waits for someone to notice it
• Keep the 20-minute promise: subscription customers get a qualified responder triaging within 20 minutes of declaring an incident, including at 3 a.m. on a Saturday
• Run the on-call rota, and take the incident lead seat yourself on the hardest cases
• Review findings and reports before a customer sees them; the evidence has to support every sentence, and the wording has to hold up in front of a lawyer
• Be the senior contact for the customer’s CISO, breach counsel, and insurer during major incidents
• Manage, mentor, and hire responders: set goals, run reviews, and protect the time people spend on research
• Turn what each case teaches into methodology, playbooks, detections, and fixes to our Rapid-IR platform
• Work with customer success and sales on scoping, and on setting up connected access for new subscription customers before their first incident

Required Qualifications

• 7+ years of hands-on incident response or DFIR
• 2+ years leading an IR team, or running the IR side of a consultancy or MSSP
• Major incidents led end to end as incident lead: ransomware, business email compromise, cloud and identity compromise
• Still hands-on: you can pick up a timeline, a memory image, or a set of cloud audit logs and find the mistake in someone’s analysis
• Cloud incident depth in AWS, Azure, Microsoft 365, or Google Workspace
• Experience writing and reviewing reports for executives, counsel, and regulators
• Calm with an angry customer on the line and a team waiting for direction
• Clear written and spoken English
• On-call availability like the rest of the team, and the escalation point when a case goes sideways; incidents don’t keep office hours
• Comfort with fully remote work, which will stay that way

Preferred Qualifications

• Work with insurer panels and breach counsel
• Built or rebuilt an on-call rota or an incident intake process
• Automation or tooling you wrote that a team still uses
• Public research, talks, or advisories

Benefits

• Fully remote work, based in Israel
• Flexible vacation plan
• Home office allowance
• Paid time for research, writing, and community work

Contact

To apply, send your resume to careers@profero.io. Include links to anything that shows your work: reports you can share, blog posts, talks, GitHub or LinkedIn. Tell us why remote work suits you.